Cisco 500-280 Braindumps To Pass Exam

Question No. 1

What is a GID?

• A. general intrusion domain
• B. Generator ID
• C. Gigabit interface definition
• D. gradual interrupt detection

Question No. 2

Which command-line argument can you use with Snort to produce a binary output file?

• A. -B
• B. -b
• C. -u
• D. -U

Question No. 3

Which pre-processor uses a global directive and an engine instance directive in the snort.conf file for configuration to provide target context during packet reassembly?

• A. frag2
• B. frag3
• C. SMTP
• D. sfPortscan

Question No. 4

A Snort sensor is generating many false-positive sfPortscan alerts, in which busy, trusted hosts are flagged as the source of port sweep events. Which tuning strategy can mitigate this problem?

• A. Add the host to the Ignore Scanner list.
• B. Add the host to the Ignore Scanned list.
• C. Add the host to the Watch IP list.
• D. Apply a rule threshold.

Question No. 5

To accept input from Snort and produce various forms of output, the Barnyard architecture consists of which components?

• A. preprocessors and reassemblers
• B. preprocessors and detection engine
• C. data processors and output plug-ins
• D. data processors and reassemblers

Question No. 6

Which information does the rule body contain?

• A. source IP
• B. protocol
• C. port number
• D. specification of which portion of a packet payload to examine